Right Method, Wrong Order

In today’s digital age, extracting data from mobile devices is an essential aspect of forensic investigations. However, it must be done carefully and correctly to ensure the highest possible level of accuracy and reliability. To accomplish this, the appropriate extraction methods should be used in the right order, considering all available options for a given device running a specific version of the operating system. So what is the best order of extraction methods when acquiring an iPhone? Read along to find out.

🧑‍💻 https://blog.elcomsoft.com/2023/02/right-method-wrong-order/

#apple #ios #checkm8 #EIFT #EPB #EPV #mobileforensics #dfir

🆕Elcomsoft Phone Breaker 11 Restores iCloud Access🆕

Elcomsoft Phone Breaker 11 restores extraction capabilities for most data categories including synchronized data, iCloud Drive, and iCloud backups🏙

Extracting cloud data becomes increasingly valuable – and increasingly complex at the same time. In scenarios where a target device is physically unavailable cloud extraction is often the only real way to access evidence.

This is particularly relevant when devices are secured by an unknown passcode or locked under Apple’s Stolen Device Protection framework without available biometric authentication, rendering traditional extraction techniques ineffective.

Apple’s cloud ecosystem aggregates synchronized data from all devices tied to a specific Apple ID, providing forensic specialists with a comprehensive, cross-device dataset rather than a fragmented, single-device view. Accessing this data, however, requires more and more efforts🗄️

Beginning with the rollout of iOS 18, Apple initiated substantial modifications to its cloud infrastructure and access mechanisms. While backward compatibility with legacy access protocols was temporarily maintained to support devices running older versions of iOS, Apple executed a definitive cut-off in January and February of 2026. During this window, the old protocols were permanently blocked, and cloud authentication procedures were entirely overhauled, rendering prior extraction methods obsolete.

More information at the link📎

#EPB #iCloud

🆕Downloading iPhone and iPad backups from Apple iCloud🆕

Pulling a backup out of iCloud is one of the more technically demanding jobs in cloud forensics.
An iCloud backup is not a single, ready-to-download file: instead, it is assembled from a large number of separate fragments that have to be collected and stitched back together into a coherent backup☁️

Recent changes to Apple’s communication protocols broke things for everyone except Apple themselves, meaning that we had to rework the underlying extraction logic. This is documented in Elcomsoft Phone Breaker 11 Restores iCloud Access.

Recent changes to Apple’s communication protocols and to the format of certain server responses meant that logic had to be substantially reworked. The first pass in version 11.0 had teething issues: backups could stop partway through, often after only the first few gigabytes...

⚡️...Version 11.1 applies the final fixes! Backups that previously stalled now download completely, and the reconstruction step produces a consistent backup you can actually work with – but only if the backup was made by a device running iOS or iPadOS 18 or lower. Cloud backups produced by iOS or iPadOS 26 are not supported just yet. Support for them is coming in a follow-up release😊

More information at the link📎

#EPB #iCloud

🆕Downloading iOS 26 iCloud Backups🆕

Elcomsoft Phone Breaker 11.2 adds the ability to download iCloud backups created on devices running iOS and iPadOS 26 and, by extension, iOS/iPadOS 27 beta.

⚡️With this release, Elcomsoft Phone Breaker becomes the first and only third-party tool capable of pulling these backups from Apple’s cloud. That might read like a routine compatibility update. It isn’t. In iOS 26, Apple reworked its iCloud backup mechanism from the ground up, breaking every third-party tool that relied on the previous scheme. Restoring access meant rebuilding a large part of our cloud extraction pipeline. Below is what changed, what we did about it, and where the current build still has rough edges.

Roughly the only thing left untouched is the authentication protocol – every other layer between an authenticated session and a reconstructed backup was redesigned. For example, the chunks that make up a single backup may be spread across multiple back-end servers, with different hosts holding different parts of the same copy.

Taken together, these changes made every existing third-party forensic tool incompatible with iOS 26 backups. Adding support wasn’t a matter of patching a parser; it required reworking the entire engine.

Let's talk about what we fixed❤️

More information at the link📎

#EPB #iCloud

🆕Two-Factor Authentication and iCloud: A Short History, and What We Fixed in Phone Breaker 11.03🆕

Two-factor authentication is the least glamorous security feature, and probably the most important one.

A password is “something you know”, which really means “something that can be phished, reused, leaked, or guessed”.

The second factor is “something you have”, and, while it can still be phished, it makes stolen passwords much less of a catastrophe they used to be. Everything else in account security is built on top of that. If the second factor is not there, or if it does not cover the data that actually matters, the rest is decoration.

Apple gets this right today. They did not always. The story of how they got here is worth telling, because it explains a lot about how iCloud acquisition works in 2026, and it leads directly to the two 2FA-related fixes in Elcomsoft Phone Breaker 11.03.

More information at the link📎

#EPB

🆕Elcomsoft Phone Breaker 11.05: iCloud extraction support for iOS 27 and the iPhone 18 range🆕

⚡️Elcomsoft Phone Breaker 11.05 adds support for iCloud backups of iOS 27 and iPadOS 27 devices, including the iPhone 18 lineup, and restores access to iCloud data on accounts where every registered device runs OS version 26 or 27.

The update includes:

⏺iCloud: added support for iPhone 18, 18 Pro, 18 Pro Max, and 18 Duo cloud backups
⏺iCloud: added support for iOS 27 and iPadOS 27 iCloud backups
⏺iCloud: improved support for iCloud data (backups, synced, files) for accounts with OS 26/27 devices only
⏺Bugfix: fixed program initialization issue on Intel-based Macs

More information at the link📎

#EPB